usb: dwc3: ep0: fix DMA starvation by assigning req->trb on ep0

commit 55168470835688e5da5828cdcf1b1498d7baadb1 upstream.

If we don't assign a TRB to ep0 requests, we won't be able to unmap
the request later on resulting in starvation of DMA resources.

Fixes: 4a71fcb8ac5f ("usb: dwc3: gadget: only unmap requests from DMA if mapped")
Reported-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Tested-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 827e376bfa97106f1ccbeefcad40bc2a05357c8b..75e6cb044eb2b96d173a2c716bb29f5f4fd7f703 100644 (file)
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -990,6 +990,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                                         DWC3_TRBCTL_CONTROL_DATA,
                                         true);
 
+               req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
+
                /* Now prepare one extra TRB to align transfer size */
                dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
                                         maxpacket - rem,
@@ -1015,6 +1017,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                                         DWC3_TRBCTL_CONTROL_DATA,
                                         true);
 
+               req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
+
                /* Now prepare one extra TRB to align transfer size */
                dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
                                         0, DWC3_TRBCTL_CONTROL_DATA,
@@ -1029,6 +1033,9 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                dwc3_ep0_prepare_one_trb(dep, req->request.dma,
                                req->request.length, DWC3_TRBCTL_CONTROL_DATA,
                                false);
+
+               req->trb = &dwc->ep0_trb[dep->trb_enqueue];
+
                ret = dwc3_ep0_start_trans(dep);
        }